What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Discussion

Windows WMF 0-day exploit in the wild

29 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Post #16
FYI…

- http://www.f-secure.com/weblog/archives/ar…6.html#00000758
Sunday, January 1, 2006 - 00:49 GMT
"We are aware that a new exploit for the WMF vulnerability has been published. This one is much more advanced than the old one, and much more dangerous.
It enables clueless newcomers to easily craft highly variable and hard-to-detect variations of image files. Images that take over computers when viewed. And do this on all common Windows platforms. With no vendor patch for the vulnerability available. Meaning that there are hundreds of millions of vulnerable computers in the net right now.
Making such tools publicly available when there's no vendor patch available is irresponsible. Plain and simply irresponsible. Everybody associated in making and publishing the exploit knows this. And they should know better. Moore, A.S, San and FrSIRT: you should know better."

2nd generation WMF 0-day Expliot Spammed
- http://isc.sans.org/diary.php?storyid=995
Last Updated: 2006-01-01 11:06:07 UTC
"According to F-Secure's blog today*, the 2nd generation WMF exploit has been spammed and "When the HappyNewYear.jpg hits the hard drive and is accessed (file opened, folder viewed, file indexed by Google Desktop), it executes and downloads a Bifrose backdoor (detected by us as Backdoor.Win32.Bifrose.kt) from www[dot]ritztours.com.".
Trend Micro is calling it TROJ_NASCENE.H":
- http://www.trendmicro.com/vinfo/virusencyc…ENE%2EH&VSect;=T

* http://www.f-secure.com/weblog/archives/ar…6.html#00000759
Sunday, January 1, 2006 - 09:38 GMT
"Some clown is spamming out "Happy New Year" emails which will infect Windows machines very easily. These emails contain a new version of the WMF exploit, which doesn't seem to be related to the two earlier Metasploit WMF exploits we've seen. The emails have a Subject: "Happy New Year", body: "picture of 2006" and contain an exploit WMF as an attachment, named "HappyNewYear.jpg" (MD5: DBB27F839C8491E57EBCC9445BABB755). We detect this as PFV-Exploit.D.
When the HappyNewYear.jpg hits the hard drive and is accessed (file opened, folder viewed, file indexed by Google Desktop), it executes and downloads a Bifrose backdoor (detected by us as Backdoor.Win32.Bifrose.kt) from www[dot]ritztours.com. Admins, filter this domain at your firewalls.
It's going to get worse…"

:ph34r:
Post #17
FYI…

Trustworthy Computing
- http://isc.sans.org/diary.php?storyid=996
Last Updated: 2006-01-01 15:47:02 UTC by Tom Liston (Version: 1)
"Looking forward to the week ahead, I find myself in the very peculiar position of having to say something that I don't believe has ever been said here in the Handler's diary before: "Please, trust us."
I've written more than a few diaries, and I've often been silly or said funny things, but now, I'm being as straightforward and honest as I can possibly be: the Microsoft WMF vulnerability is bad. It is very, very bad.
We've received many emails from people saying that no one in a corporate environment will find using an unofficial patch acceptable. Acceptable or not, folks, you have to trust someone in this situation.
To the best of my knowledge, over the past 5 years, this rag-tag group of volunteers hasn't asked for your trust: we've earned it. Now we're going to expend some of that hard-earned trust:
This is a bad situation that will only get worse. The very best response that our collective wisdom can create is contained in this advice - unregister shimgvw.dll and use the unofficial patch. You need to trust us.
Looking back over the past year, the ISC handlers have faced up to any number of challenges: from worms and viruses to DNS poisoning and hurricanes. We've done our best to keep you informed and to tell it like it is. Somehow, it seems fitting that on the last day of 2005 we rang in the New Year in what can only be described as typical ISC style.
On December 31st, we received word that a "new and improved" version of the WMF exploit had been published. This new exploit code generated WMF files that were sufficiently different that they bypassed nearly all AV and IDS signatures. Publishing exploit code such as this for an unpatched vulnerability on a holiday weekend is, without any doubt, a totally irresponsible act.
And so, as the hours to the New Year slowly counted down, a group of volunteers gave up their holiday weekend to come together as a team and put their collective knowledge and intellect to work on the problems this reckless disclosure created. Some tested the exploit, some talked to AV vendors, some worked toward finding a means to mitigate the vulnerability, some tested "fix" ideas and the resulting patches.
I was privileged to be a part of that team, and I'm incredibly proud of everyone who participated. As it became obvious that the "fix" that we were working toward was essentially what had already been created by Ilfak Guilfanov, we wrote to him to ask if we could redistribute his patch from the ISC*. He was incredibly gracious and courteous in allowing us to do so and we were able to work with him to verify several changes that allowed the patch to work on a wider variety of Windows systems.

We have very carefully scrutinized this patch. It does only what is advertised, it is reversible, and, in our opinion, it is both safe and effective.
The word from Redmond isn't encouraging. We've heard nothing to indicate that we're going to see anything from Microsoft before January 9th.
The upshot is this: You cannot wait for the official MS patch, you cannot block this one at the border, and you cannot leave your systems unprotected.
It's time for some real trustworthy computing. All we're asking is if we've proved ourselves to be worthy of your trust."

* >>> http://isc.sans.org/diary.php?storyid=994
(See "What can I do to protect myself?")

:ph34r:
Post #18
FYI…

Updated version of Ilfak Guilfanov's patch
- http://isc.sans.org/diary.php?storyid=999
Last Updated: 2006-01-01 18:18:10 UTC by Tom Liston (Version: 1)
"Ilfak Guilfanov has released an updated version of his unofficial patch for the Window's WMF issue. We have reverse engineered, reviewed, and vetted the version here*. Note: If you've already successfully installed the patch, this new version adds nothing new. It only adds code to make it able to install on some other very specific configurations and code to recognize when the patch has already been installed."
* http://handlers.sans.org/tliston/wmffix_hexblog13.exe

:thumbup:
Post #20
FYI…

Malicious Website / Malicious Code: WMF Attack Update / Timeline
- http://www.websensesecuritylabs.com/alerts…php?AlertID=390
January 02, 2006
"…The attack is a vulnerability within Windows Operating Systems which currently has no patch available. Because there is no patch from Microsoft available, there is exploit code published on the web, its trivial to create and attack, and there are multiple vectors which allow you to use this attack, we believe that there will continue to be exploits through the Web, Instant Messaging, Email, and other technologies over the next week…
Jan 1, 2006: Increase in web-attacks. Now more than 100 sites using exploit to install BOT's and Trojan Horses.
Jan2, 2006: Targeted Trojan Horse attack discovered via email…"

:ph34r:
Post #21
FYI…

- http://isc.sans.org/diary.php?storyid=1004
Last Updated: 2006-01-02 22:34:08 UTC
"…A reminder: be sure to test the patch above before deploying it across an enterprise. While the handlers (including me) are running it on our own personal systems and it works as advertised, we can't vouch for any special software you might have in your own systems that could be disabled after the patch is installed."


:oops:
Post #22
FYI…

Microsoft Security Advisory (912840)
Vulnerability in Graphics Rendering Engine Could Allow Remote Code Execution.
- http://www.microsoft.com/technet/security/…ory/912840.mspx
Updated: January 3, 2006
"…> What’s Microsoft’s response to the availability of third party patches for the WMF vulnerability?
Microsoft recommends that customers download and deploy the security update for the WMF vulnerability that we are targeting for release on January 10, 2006.
As a general rule, it is a best practice to utilize security updates for software vulnerabilities from the original vendor of the software. With Microsoft software, Microsoft carefully reviews and tests security updates to ensure that they are of high quality and have been evaluated thoroughly for application compatibility. In addition, Microsoft’s security updates are offered in 23 languages for all affected versions of the software simultaneously.
Microsoft cannot provide similar assurance for independent third party security updates.
> Why is it taking Microsoft so long to issue a security update?
Creating security updates that effectively fix vulnerabilities is an extensive process. There are many factors that impact the length of time between the discovery of a vulnerability and the release of a security update. When a potential vulnerability is reported, designated product specific security experts investigate the scope and impact of a threat on the affected product. Once the MSRC knows the extent and the severity of the vulnerability, they work to develop an update for every supported version affected. Once the update is built, it must be tested with the different operating systems and applications it affects, then localized for many markets and languages across the globe…"

.
Post #23
Windows WMF flaw: How to protect against attacks
There is no vendor-sanctioned fix yet for the Windows Metafile vulnerability
Source Link

News Story by Sharon Machlis

JANUARY 02, 2006 (COMPUTERWORLD) - With Microsoft promising a security update "upon completion of [an] investigation" of the WMF security flaw, there's currently no vendor-sanctioned fix for the Windows Metafile vulnerability (see "Risk of Windows WMF attacks jumps 'significantly,' security firm warns").
However, there are ways to protect your system and network from potential attack.


"If you are a Windows OneCare user and your current status is green, you are already protected from known malware that uses this vulnerability to attempt to attack systems," according to Microsoft. If not, there are several other defense strategies, including the following:


Unregister the Windows shimgvw.dll file. The command regsvr32 -u %windir%\system32\shimgvw.dll at the command-line prompt should do this on an individual system. "This workaround is better than just trying to filter files with a WMF extension," according to security firm F-Secure Corp., since some malicious WMF files are being disguised with other file extensions.

Ilfak Guilfanov, "the main author of Interactive Disassembler Pro and … arguably one of the best low-level Windows experts in the world," F-Secure says, has posted a temporary fix at hexblog.com. Security firm iDefense Inc. says it tested the patch and verified that it's effective and doesn't seem to include malicious code. But it notes that the patch "is still from an independent source and not the actual vendor, and should be treated as such." SANS Institute also says that it has "reverse engineered, reviewed and vetted" the fix. Guilfanov recommends uninstalling his workaround once Microsoft issues an official fix.

"Configure Internet Explorer to a HIGH security level," iDefense suggests in a listing of several protection strategies.

Block several IP addresses that have been associated with malicious activity in the past, according to Johannes Ullrich at SANS. Details are posted on the SANS Internet Storm Center diary.

"WMF exploitation has rapidly become a major threat, especially as the work week resumes after a long holiday weekend," iDefense spokesman Ken Dunham said in an e-mail advisory. "The situation is rapidly escalating now with hundreds of hostile sites purported, dozens confirmed, and more from public and private data shared to date. …Traditionally, any rapid exploitation on a widespread basis within seven days or less has led to a major meta-event."


The following resources provide more information on the WMF vulnerability:



F-Secure's blog

Hexblog

Steve Gibson's explainer of the fix on Hexblog

SANS Internet Storm Center diary

Microsoft's initial security advisory

For additional Computerworld coverage, see



"WMF flaw can't wait for Microsoft fix, researchers say"

"Risk of Windows WMF attacks jumps 'significantly,' security firm warns"
Post #24
FYI…

Oxy-morons
- http://isc.sans.org/diary.php?storyid=1011
Last Updated: 2006-01-03 18:17:57 UTC by Tom Liston (Version: 1)
"Although the issue is serious and malicious attacks are being attempted, Microsoft's intelligence sources indicate that the scope of the attacks are not widespread."
- Microsoft Security Advisory (912840)

"…Microsoft's intelligence sources…"?!?

Go ahead and laugh. I'll wait.

Through? O.K. While all of the rest of us were sleeping, it appears that the propeller-heads working on Billy Wonka's Official Microsoft Research and Development Team have been hard at work creating a crystal ball capable of foretelling the future. The only problem: it appears that they made it from rose-colored crystal.
In their rosy vision of the future, over the next seven days, nothing bad is going to happen. The fact that there are point-n-click toolz to build malicious WMFs chock full o' whatever badness the kiddiez can cook up doesn't exist in that future. The merry, lil' Redmond Oompa Loompas are chanting "Our patch isn't ready / you have to wait / so keep antivirus / up-to-date" which makes perfectly accurate, current AV signatures appear on every Windows computer - even those with no antivirus software.
The future, according to Microsoft, is a wonderful, safe, chocolaty place.
And why not? Everything just seems to work out for them!
Imagine! You have tons and tons of work to do! Even now, the Oompa Loompas are hard at work out in Redmond, simultaneously regression-testing and translating Microsoft's WMF patch into Swahili and Urdu. And, somehow, as if by magic, all of this work will wind down at precisely the right moment so that the WMF patch doesn't have to be released "out of cycle." How convenient! Especially if you're wanting to avoid all of that nasty "Microsoft Releases Emergency Patch" publicity.
And remember, if something bad does happen to you during the next seven days, Billy Wonka and his Magic Metafiles aren't to blame. You are!
"Customers who follow safe browsing best practices are not likely to be compromised by any exploitation of the WMF vulnerability. Users should take care not to visit unfamiliar or un-trusted Web sites that could potentially host the malicious code."
Why are you visiting places on the web you've never been before? Restrict your browsing to safe places*, and everything will be just fine. 'Cause no one could ever put a bad graphic file on a place you trust**."
* http://handlers.dshield.org/jullrich/wmffaq.html

** http://www.microsoft.com/uk/Apocalypse.gif

:oops:
Post #25

Thanks. Much of the information that has been available was very confusing and you put it together for me.

Does anyone know how to block web sites in FireFox?

There is a spyware blocking utility available for free called spywareblaster. Download it from Javacool software at www.javacoolsoftware.com/spywareblaster.html . It allows you to block sites in Firefox and IE.
Post #26
FYI…

Preparing for Battle
- http://isc.sans.org/diary.php?storyid=1014
Last Updated: 2006-01-04 20:40:11 UTC
"Are you ready to battle a large virus/worm outbreak? Please don't view this is a prediction that there will be a large event, but let me just say that conditions are right for a big storm (WMF issue and the return of the Sober worm). Regarding the WMF issue, you have probably decided to either wait for the official Microsoft patch, or you are rolling out Ilfak's patch. But there is still about 6-10 days of risk here for a major worldwide event. So here are some recommendations for preparing for the battle. (This is primarily written for system and network admins…)

Prepare a short briefing for management on the situation:
1) There is a serious vulnerability in Microsoft operating systems.
2) An official patch will not be available from Microsoft until Jan. 10.
3) There are multiple propogation vectors: e-mail, instant messaging, web surfing, etc.
4) Several different versions of the exploit are in the wild and are being actively used by criminal groups. All propogation methods are being used. As of Wednesday, Jan 4 20:15:00 UTC, our current poll indicates that 22% of respondents (340) have seen exploit attempts through one of the exploitation vectors.
5) Tools to generate random files to exploit the vulnerability are publicly available. These tools may be used to evade anti-virus and IDS/IPS signatures.
6) Anti-virus signatures and intrusion detection/prevention system signatures may only be able to catch the first generation of exploits.
7) If an outbreak does occur, how are you going to sanitize laptops that were infected outside of your network before allowing them to connect to your internal network?

As you provide this information, you should also provide an action plan for mitigating damage in the worst case scenario. You should consider the following action items in your plan. Also consider that your organization may have no internal infections, but that the rest of the Internet is having problems. Solicit input from your management on the circumstances that would dictate each of the actions below.

1) Disconnect from the Internet.
2) Disconnect specific services from the Internet. Talk with your network/firewall admins and have them be prepared to shut-off specific services (SMTP or HTTP) at strategic locations.
3) If you have multiple locations, consider the action plan of disconnecting internal WAN pipes to minimize damage to other parts of your organization.
4) Disconnect internal and/or external e-mail servers to prevent further damage.
5) If you plan to perform any of the above actions, then you should also plan on how to bring these sites/services back online.
6) Determine an action plan for local workstation admins. How are they going to receive virus updates and virus removal tools to clean workstations?

You should take this time to validate that you have good backups of your e-mail servers. If things go really badly, you may be restoring from backup. You should also make sure that everyone that could be involved in the incident response has an updated contact list (cell phones, pagers, home phones, etc) for all of the appropriate operational personnel. Remember that some of these communication methods may fail during a virus outbreak. Finally, you should identify secondary Internet access (maybe dial-up) to download virus updates, IDS/IPS updates, or get latest news about the event. In a virus outbreak/worm event, communication between the operational folks and management is critical. Make sure that there is a clear understanding of when/how to shut-off services and when/how to turn them back on. Communication to end-users is also critical and you may want to start informing them now that the next 6-10 days could be very difficult times.

You can find much more information about incident response plans at the following sites:

http://www.intrusions.org/
http://www.sans.org/rr/whitepapers/incident/
http://www.cert.org/archive/pdf/csirt-handbook.pdf …"

:oops:
Post #28 last edited
FYI…and the (minor) details are:

MS Security Bulletin MS06-001
Vulnerability in Graphics Rendering Engine Could Allow Remote Code Execution (912919)
http://www.microsoft.com/technet/security/…n/ms06-001.mspx
Published: January 5, 2006
Version: 1.0
Summary
Who should read this document: Customers who use Microsoft Windows
Impact of Vulnerability: Remote Code Execution
Maximum Severity Rating: Critical…
Vulnerability Details
Graphics Rendering Engine Vulnerability - CVE-2005-4560:
A remote code execution vulnerability exists in the Graphics Rendering Engine because of the way that it handles Windows Metafile (WMF) images. An attacker could exploit the vulnerability by constructing a specially crafted WMF image that could potentially allow remote code execution if a user visited a malicious Web site or opened a specially crafted attachment in e-mail. An attacker who successfully exploited this vulnerability could take complete control of an affected system…"

Microsoft Patches Released
- http://isc.sans.org/diary.php?storyid=1019
Last Updated: 2006-01-05 21:47:54 UTC
"Many of you already know this if you receive advance notification from Microsoft. For everybody else, see their announcement about an early release of the WMF patch. The patch and details about it are available here. If you have installed any of the earlier patches or workarounds, here is our recommendation for updating:
1. Reboot your system to clear any vulnerable files from memory
2. Download and apply the new patch
3. Reboot
4. Uninstall the unofficial patch, by using Add/Remove Programs on single systems. If you used msi to install the patch on multiple machines you can uninstall it with this:
msiexec.exe /X{E1CDC5B0-7AFB-11DA-8CD6-0800200C9A66} /qn
5. Re-register the .dll if you previously unregistered it (use the same command but without the "-u"):
regsvr32 %windir%\system32\shimgvw.dll
6. Reboot one more time just for good measure…"

:oops:
Post #29
FYI…

- http://www.websensesecuritylabs.com/alerts…php?AlertID=392
January 05, 2006
"…Websense® Security Labs™ was acknowledged as a contributor in the bulletin from Microsoft.
http://www.microsoft.com/technet/security/…n/ms06-001.mspx
At this time more than 1100 URLs are still actively attempting to exploit users who have not installed the patch. Most attacks are Trojan horse downloaders which update over HTTP and install and run other pieces of malicious code. Depending on your patch rollout procedures, we still recommend that customers block all URLs that end in .WMF…"

:(
Post #30
FYI…

- http://isc.sans.org/diary.php?storyid=1023
Last Updated: 2006-01-06 20:57:58 UTC
"…The Internet Storm Center is made up of a group of volunteers that have different backgrounds and perspectives on the overall risk of the WMF vulnerability, and the active exploitation seen. The group consensus was that the risk was high enough to warrant raising the Infocon level, and then testing and endorsing the unofficial patch. We are well aware that one size doesn't fit all. At the time it was the only mitigation technique that actually worked. Anti-virus, IDS/IPS do not give adequate protection against this attack and all of its vectors…"

Get the patch now. Choose Windows Update, MS Update, or manual download. But get it NOW. Other subliminal messages may be posted at anytime…

:oops: